6 ms·

"Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? (I say this not to be a jerk, but because there

"Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? (I say this not to be a jerk, but because there aren't exactly a wealth of good alternatives given it is a distributed source control mechanism. PKI comes with the territory and an SSH key generation is part of that) GitHub doesn't take any more setup than a standard Git setup takes (well, outside of signing up, a very short process anyhow). Install the Git client via the Windows installer, (point and click, a minute, tops). Generate an SSH key. Upload the id_rsa.pub. Done. I mean, it would be one thing if they left users in the dark about this, but I'm fairly sure that the "Thanks for signing up page" links directly to the OS-specific meticulous step-by-step instructions of generating the key. I'm not sure you understand what it means to be flamed. Every one of the comments is specific about your misconceptions and why signing up for a GitHub account is as trivially easy as signing up for a Twitter account. (Using GitHub as an oAuth account does not require actually uploading a public key)

ctz 14y ago
PKI has nothing to do with SSH keys. Github's use of SSH does not use certificates, and github has no certification infrastructure.
- drivebyacct2 14y ago
  My apologies, I abuse "PKI" to mean "PK infrastructure" (which I know is what the acronym stands for, I'm making a bit of tongue-in-cheek commentary), I think it's silly that PKI implicitly means CAs but according to Wikipedia at least, you're correct.
  - nknight 14y ago
    No, he isn't, and the relevant Wikipedia article is very poorly written. PKI is a highly generic term. Webs of trust are just as much a PKI as a certificate-based system. Everything you've said in this thread has been bang-on, and the replies you're getting are deeply depressing.
    - toddheasley 14y ago
      Can we at least agree that if we attempted a list of all the Xs a programmer needs to know before doing Y and made it law that nobody could write any software at all?
      - rbanffy 14y ago
        Understanding key pairs is very basic knowledge. I don't expect people to understand everything, but things like this, I do. It's dangerous not to.
eli 14y ago
For many people there Github = git, so saying github isn't much harder to set up than Git isn't saying much. Using git on Windows has historically not been super fun. The CLI installer mostly works, but it's pretty clunky. Cygwin works fine too, but it's also not especially elegant. At the very least, known of these solutions conform to the expectations of people of the platform. The GUI clients on Windows last I looked (a year ago) were pretty terrible, especially compared to TortoiseSVN, which isn't bad. OS X, on the other hand, had several very nice GUI clients even before the official Github client came out.
- drivebyacct2 14y ago
  I don't know what difference the "Github = git" distinction makes, from an oAuth perspective it still seems implicitly obvious to me that completing the signup and adding SSH keys are distinct tasks. As for "CLI installer" (I presume you mean the installer for the CLI git client), and Cygwin, I'm not sure what to say. I've used the Git installer dozens of times without problem, there aren't exactly tons of places for it to go wrong. Are there specific or particular issues you have with it? I do indeed forget that some programmers manage to make it far resisting learning to use the command line. Even with step-by-step instructions. I guess at some people I'm willing to fault the developer rather than tools that are powerful that come with good documentation.
  - thmcmahon 14y ago
    Essentially what you're saying is that you understand it; therefore it's simple to understand. Obviously GitHub believe there are people who will benefit from using Git who can't be bothered understanding setting up ssh. Seems reasonable to me.
    - drivebyacct2 14y ago
      I think you're right and I guess that's what I'm beginning to realize. I just kind of assumed that in that case... Git is the wrong tool for their job. If you don't need the "power of Git" (I swear, I'm not in love with Git), then use Dropbox or SVN or something simpler. Seems easier than fighting with keys, and then fighting with git's distributed nature and then fighting with all of the complexities of merging and conflicts. Haha, maybe another of way of putting things from my perspective, I found keys to be the least of my concerns once I got into projects that really used Git and I have a hard time seeing people be successful with Git if the keygen steps throws them off. I hope that explains things from a different perspective :)
andybak 14y ago
I get really sick of this attitude. None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. I personally have been forced to learn more low-level Unixy things than I ever wanted to. I want to write simple and elegant front and back end code quickly so I can spend my spare time honing UX and other human-facing aspects of my work. I resent being flamed because I don't fully understand the subtleties of zsh or nginx or or whatever other shiny toy someone else happens to find essential knowledge. Your world might not necessarily be mine.
- wnoise 14y ago
  > None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. Speak for yourself. All of those are fascinating.
  - extesy 14y ago
    Speak for yourself. They are fascinating for you, but not for me or many other people.
  - andybak 14y ago
    Actually. I agree with you (apart from the fact that I haven't had a chance to learn much about social psychology). I was just trying to think of examples of disciplines at opposite ends of an imagined continuum.
- drivebyacct2 14y ago
  You can't follow 3 step-by-step instructions, insult me by implying I'm flaming and then drudge up completely unrelated tools in a discussion about ssh-keygen? What do you people want? Seriously? Yes, I'd love to have a big red easy button. It could autoconfigure MySQL, and write init scripts, configure deploy environments because apache conf files are too complicated to learn. Hell, it could even write my backend code and then commit it for me too! I'm done with this ludicrous conversation. I've never seen such an ignorant-excusing entitled discussion in a "technical" community before. Downvote me because you can't follow steps or can't be bothered to learn how to use one of your most important development tools, I've lost interest.
ncarlson 14y ago
> "Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? Is this an honest question, or are you alluding to the idea that someone who doesn't understand PKI should not use distributed source control?
- uxp 14y ago
  Well, in the original quote that was cited from "scary crypto stuff" was surrounded with: Last I checked they[GitHub] made you perform a bunch of scary crypto stuff on your local machine before they'd let you in. If performing `ssh-keygen` and entering in an (optional) password from a command line constitutes "scary crypto", then maybe Git and GitHub isn't for everyone. Not that anyone needs to know how PKI works, but they might be better off knowing that `ssh-keygen` generates an ssh key pair, a pretty essential component of the `git` workflow. Maybe that's why SVN is so strong in older development shops. Outside of the effort required to convert an SVN repo to a Git repo, all those developers already have all the tools necessary on their machines (Windows is high on that list) and in many cases inside a VPN like my division we just use WebDAV anyways, completely bypassing the need for SSH Keys in favor of ActiveDirectory.

ctz 14y ago

PKI has nothing to do with SSH keys. Github's use of SSH does not use certificates, and github has no certification infrastructure.

drivebyacct2 14y ago
My apologies, I abuse "PKI" to mean "PK infrastructure" (which I know is what the acronym stands for, I'm making a bit of tongue-in-cheek commentary), I think it's silly that PKI implicitly means CAs but according to Wikipedia at least, you're correct.
- nknight 14y ago
  No, he isn't, and the relevant Wikipedia article is very poorly written. PKI is a highly generic term. Webs of trust are just as much a PKI as a certificate-based system. Everything you've said in this thread has been bang-on, and the replies you're getting are deeply depressing.
  - toddheasley 14y ago
    Can we at least agree that if we attempted a list of all the Xs a programmer needs to know before doing Y and made it law that nobody could write any software at all?
    - rbanffy 14y ago
      Understanding key pairs is very basic knowledge. I don't expect people to understand everything, but things like this, I do. It's dangerous not to.

eli 14y ago

For many people there Github = git, so saying github isn't much harder to set up than Git isn't saying much. Using git on Windows has historically not been super fun. The CLI installer mostly works, but it's pretty clunky. Cygwin works fine too, but it's also not especially elegant. At the very least, known of these solutions conform to the expectations of people of the platform. The GUI clients on Windows last I looked (a year ago) were pretty terrible, especially compared to TortoiseSVN, which isn't bad. OS X, on the other hand, had several very nice GUI clients even before the official Github client came out.

drivebyacct2 14y ago
I don't know what difference the "Github = git" distinction makes, from an oAuth perspective it still seems implicitly obvious to me that completing the signup and adding SSH keys are distinct tasks. As for "CLI installer" (I presume you mean the installer for the CLI git client), and Cygwin, I'm not sure what to say. I've used the Git installer dozens of times without problem, there aren't exactly tons of places for it to go wrong. Are there specific or particular issues you have with it? I do indeed forget that some programmers manage to make it far resisting learning to use the command line. Even with step-by-step instructions. I guess at some people I'm willing to fault the developer rather than tools that are powerful that come with good documentation.
- thmcmahon 14y ago
  Essentially what you're saying is that you understand it; therefore it's simple to understand. Obviously GitHub believe there are people who will benefit from using Git who can't be bothered understanding setting up ssh. Seems reasonable to me.
  - drivebyacct2 14y ago
    I think you're right and I guess that's what I'm beginning to realize. I just kind of assumed that in that case... Git is the wrong tool for their job. If you don't need the "power of Git" (I swear, I'm not in love with Git), then use Dropbox or SVN or something simpler. Seems easier than fighting with keys, and then fighting with git's distributed nature and then fighting with all of the complexities of merging and conflicts. Haha, maybe another of way of putting things from my perspective, I found keys to be the least of my concerns once I got into projects that really used Git and I have a hard time seeing people be successful with Git if the keygen steps throws them off. I hope that explains things from a different perspective :)

andybak 14y ago

I get really sick of this attitude. None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. I personally have been forced to learn more low-level Unixy things than I ever wanted to. I want to write simple and elegant front and back end code quickly so I can spend my spare time honing UX and other human-facing aspects of my work. I resent being flamed because I don't fully understand the subtleties of zsh or nginx or or whatever other shiny toy someone else happens to find essential knowledge. Your world might not necessarily be mine.

wnoise 14y ago
> None of us want to understand every single domain of knowledge from set theory or quantum physics up to cosmology or social psychology. Speak for yourself. All of those are fascinating.
- extesy 14y ago
  Speak for yourself. They are fascinating for you, but not for me or many other people.
- andybak 14y ago
  Actually. I agree with you (apart from the fact that I haven't had a chance to learn much about social psychology). I was just trying to think of examples of disciplines at opposite ends of an imagined continuum.
drivebyacct2 14y ago
You can't follow 3 step-by-step instructions, insult me by implying I'm flaming and then drudge up completely unrelated tools in a discussion about ssh-keygen? What do you people want? Seriously? Yes, I'd love to have a big red easy button. It could autoconfigure MySQL, and write init scripts, configure deploy environments because apache conf files are too complicated to learn. Hell, it could even write my backend code and then commit it for me too! I'm done with this ludicrous conversation. I've never seen such an ignorant-excusing entitled discussion in a "technical" community before. Downvote me because you can't follow steps or can't be bothered to learn how to use one of your most important development tools, I've lost interest.

ncarlson 14y ago

> "Scary crypto stuff"? So you don't understand how PKI works and you're trying to use distributed source control? Is this an honest question, or are you alluding to the idea that someone who doesn't understand PKI should not use distributed source control?

uxp 14y ago
Well, in the original quote that was cited from "scary crypto stuff" was surrounded with: Last I checked they[GitHub] made you perform a bunch of scary crypto stuff on your local machine before they'd let you in. If performing `ssh-keygen` and entering in an (optional) password from a command line constitutes "scary crypto", then maybe Git and GitHub isn't for everyone. Not that anyone needs to know how PKI works, but they might be better off knowing that `ssh-keygen` generates an ssh key pair, a pretty essential component of the `git` workflow. Maybe that's why SVN is so strong in older development shops. Outside of the effort required to convert an SVN repo to a Git repo, all those developers already have all the tools necessary on their machines (Windows is high on that list) and in many cases inside a VPN like my division we just use WebDAV anyways, completely bypassing the need for SSH Keys in favor of ActiveDirectory.